An individual was sanctioned for creating a fraudulent website and publishing a third party's personal data there without any legal basis.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against an individual (including the imposition of a 2,000 € fine) for breaches related to the publication of personal data on a fraudulent website without legal basis.

The case originated from a complaint by a person who discovered that their personal data, including their photograph, had been published on a website whose creation was notified to them by email on June 14, 2024.

Grounds for the decision

• Lack of legal basis for processing (Article 6(1) of the GDPR): The authority found that the sanctioned individual had registered a domain name and created a fraudulent website related to fake parking fines. On this site, they published the complainant's personal data without consent, including their name, email address, identity document number, and photograph. The authority concluded that this public disclosure of data constituted processing without any legal basis within the meaning of Article 6(1) of the GDPR. The individual's responsibility was established through information provided by the domain registrar and the telephone operator, who identified them as the holder of the domain and associated phone line.

Authority's decision

Consequently, the authority imposed a fine of 2,000 € on the responsible individual.

Lessons learned

This decision reminds that:

• Publishing personal data on a publicly accessible website is processing that must imperatively rely on one of the legal bases listed in Article 6 of the GDPR.
• An individual who registers a domain name and manages a website where personal data are processed is considered a data controller and must comply with the GDPR obligations.
• Supervisory authorities can rely on information held by domain name registrars and telecommunications operators to identify data controllers operating online.
• Creating a fraudulent website to deceive users and unauthorized publication of personal data constitute a clear violation of the principle of lawfulness of processing.